Privacy Policy

Controller

Forever Meridian operates Holdfast. Contact holdfast@forevermeridian.com for privacy requests. The operator of a deployed instance is the controller for that instance.

Data we collect

• Account identifiers: name, email, authentication provider ids
• Workspace content: vendor records, dates, spend, notes, letter drafts, optional pasted contract text
• Usage: plan selection, timestamps of decisions and letter drafts
• Technical: IP address and user agent on requests, cookies required for session

How we use it

To authenticate you, store your vendor book, calculate action dates, draft letters, enforce plan limits, and keep the service secure. We do not sell personal data.

Processors

Hosting and database providers process data to run the app. On the Firm plan, pasted clauses may be sent to xAI for extraction. Authentication may involve Google or X if you choose those sign-in methods.

Cookies

Essential session cookies keep you signed in. We do not use advertising cookies. If you later add analytics, disclose the vendor and provide a non-essential opt-out.

Retention

Account and workspace data is kept while the account is open. After deletion, residual backups may persist for up to 30 days. Logs are kept only as long as needed for security.

Your rights

Depending on your location you may have rights to access, correct, export, or delete personal data. Contact the operator. Do not put special-category data in notes.

Children

Holdfast is a business product. It is not directed at children under 16.

Counsel review

This policy is a draft. Have privacy counsel review it for your entity and jurisdictions.